CVE-2026-52829

The record

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0.

Affected packages

Related vulnerabilities

• CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-617
• CVE-2026-105753 vLLM is an inference and serving engine for large language models. CWE-617
• CVE-2026-98151 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG… CWE-617
• CVE-2026-84450 libheif is a HEIF and AVIF file format decoder and encoder. CWE-617
• CVE-2026-8674 Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN… CWE-617
• CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the… CWE-617
• CVE-2026-76163 If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block… CWE-617
• CVE-2026-86317 A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. CWE-617